CVE-2026-129449 | DrayTek Vigor2960 up to 1.5.1.6 mainfunction.cgi sub_14914 swmconfigupload command injection

November 14, 2026 Yanac

A vulnerability, which was classified as very critical, has been found in DrayTek Vigor2960 up to 1.5.1.6. Affected by this vulnerability is the function sub_14914 of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument swmconfigupload leads to command injection.

This vulnerability is traded as CVE-2026-129449. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

It is advisable to upgrade the affected component.

The vendor recommends: “1.5.1.6 isn’t the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported.”VulDB Recent EntriesRead More